Topic
Security Automation
Within the Topic facet, Security Automation topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
History
The UDP Table Knew the Port, Not the Conversation: RFC 2013
RFC 2013 gave a network manager two kinds of sight: four odometers for an entire UDP engine and a list of local doors where applications were listening. It could say that a door existed and that traffic totals moved. It could not say who stood outside, which process answered, or…
History
A CHAP Success Proved One Comparison, Not the Connection: RFC 1994
The decisive packet in CHAP was called Success. Its name sounded broader than its evidence: one authenticator had compared one response with one locally calculated value for one challenge. RFC 1994 made that comparison useful by binding it to time and direction—and left every…
IETF
The Hidden Service Answered. The Onion Key Had Not Yet Spoken: RFC 9799
The hidden service answered over Tor, the ACME account was valid, and the final CSR was ready. None of those facts yet proved that the applicant controlled the `.onion` identity. RFC 9799 makes that missing proof explicit—and shows why issuance authority, descriptor visibility…
IETF
A Company-Certs Endpoint Cannot Prove Who Approved a Trust-Anchor Rollover
At 10:00, an application retrieves two valid private-CA chains from its company’s well-known HTTPS endpoint. The older chain still works; the newer chain has the later `valid_from`, so the client selects it exactly as the draft describes. TLS validation passed, the JSON parsed…
Story
APNIC Closed Its CentOS Workstream. The Evidence Chain Still Has Four Open Joins
APNIC can point to a genuine finish line: in the second quarter of 2026 it completed a multi-year move away from end-of-life CentOS hosts. Its wider security record is less linear. Tests, findings, classifications and exercises appear in separate reports, but the public evidence…
History
One Packet Became Several Frames, and Several Packets Became One: RFC 1993
RFC 1993 recorded a compression design in which the most intuitive boundary on a serial link—the frame edge—stopped being the boundary that mattered. Its Gandalf FZA stream could gather several original PPP packets into one compressed frame or carry a single original packet…
History
The State Table Was Also a Kill Switch: RFC 2012
In RFC 2012, a manager could inspect a TCP connection in one moment and erase its host-side existence in the next. The same row that reported state also accepted `deleteTCB(12)`, turning a table of observations into a remote intervention surface whose consequences extended well…
IETF
A Workload Credential Can Outlive the Attestation Decision Behind It
At 09:00 a workload proves that it is running in Germany and receives an eight-hour credential. At 09:05 the orchestrator moves it to France. The credential still verifies, the key is still under the workload’s control, and the unchanged service still accepts it. Yet one fact…
CASE FILE
The object survived five spellings. Which bytes were signed? RFC 9804
RFC 9804 gives SPKI S-expressions a precise route between readable notation, channel-safe transport, canonical octets and local memory. The route is reversible only when each transition is evidenced. A familiar-looking expression, a display hint or a successful parse cannot by…
Global Cloud Services Trends
Thrive targets wider detection and narrower access
Elastic and Cato Networks support different parts of Thrive’s security refresh. One expands the evidence available to analysts; the other limits the applications a user may reach.
IETF
A Key Transparency Proof Cannot Audit Who Was Allowed to Look
Alice searches a Key Transparency log for Bob and receives a valid proof. Fred makes the same request and is stopped by the application before the log sees it. The proof can show that Alice’s answer fits an authenticated, globally consistent tree. It cannot show why Alice was…
IETF
The Stream Was Ordered. The Network Was Not Yet Proven
At the instant a controller receives `<rpc-reply><ok/></rpc-reply>`, the change can feel complete. The bytes arrived in order, the peer was authenticated, and the server returned success. Yet each of those facts belongs to a different evidentiary layer from the question operators…
CASE FILE
The UK Rejected a VPN Age Gate. Its Platform Enforcement Test Is Still Pending
Britain has made a clear choice about where not to enforce its child-safety policy: it will neither ban VPNs nor require VPN services to age-gate their users. Control has not disappeared, however. The government plans to place the burden on in-scope platforms to detect and…
IETF
The Envelope Parsed. The Observation Is Not Yet Proven
`draft-ietf-netconf-notif-envelope-05` gives YANG-Push notifications a header that can travel with the message. That makes correlation easier. It does not collapse identity, continuity, time, provenance and operational truth into one successful parse.
History
The Message Opened. That Did Not Mean the Evidence Was Complete: RFC 1991
An early PGP message could pass through six visibly successful operations—ASCII decoding, packet parsing, session-key recovery, decryption, decompression and signature verification—without any one of them proving who controlled the key, when the act occurred, whether it was…
IETF
A Delegation Chain Narrows Authority but Cannot Carry Intent
An OAuth resource server may one day receive a chain whose signatures, key links, audiences, time bounds and permission subsets all validate. That green result would be meaningful: no downstream client could have validly enlarged the authority it received. It would still leave a…
CASE FILE
The Two Routes Arrived. Their Bits Still Did Not Belong Together: RFC 9819
An ingress PE can possess the two BGP advertisements required to construct an SRv6 Service SID and still lack permission to treat their bits as one executable instruction. RFC 9819 makes the missing proof visible: identity, argument size, insertion boundary, local acceptance…
IETF
A Physical-Site Receipt Can Be External to the Issuer—and Still Controlled by the Site Owner
Revision 03 of a proposed receipt for work at physical sites fixes several ambiguities with admirable candour. It also names a trust edge its own bytes cannot carry. A transparency service may be independent of the receipt issuer yet operated by the owner of the site whose…
CASE FILE
The Datastore Was Complete. The Control Plane Was Still Unproven: RFC 9826
A clean PCEP management tree can show an entity, its peers, live-looking sessions, notifications and counters in one coherent view. That coherence is a major operational gain. It is also where evidence from a management projection is most easily mistaken for proof of the network…
IETF
The Message Reassembled. The Telemetry May Still Be Incomplete
`draft-ietf-netconf-udp-notif-26` makes high-frequency YANG notifications cheaper to move across a controlled network. It also makes an important distinction unavoidable: transport evidence can show what a receiver assembled, but only a wider chain can show what the network…